refactor(webhook): extract webhook API router + profile admission (Webhook Feature Package)

[andrexibiza]

Part of the Webhook Feature Package Feature Package.

Behavior-preserving extractions from the webhook god-files, rebased onto current main (1d3d021):

1. refactor(web): extract webhook API router without behavior change — moves the webhook REST cluster from hermes_cli/web_server.py (18K-line god-file) into hermes_cli/web_routers/webhooks.py, re-exporting patched names through hermes_cli.web_server for existing tests/users.
2. fix(web): preserve webhook summary monkeypatch seam — keeps the summary endpoint monkeypatch-compatible.
3. refactor(webhook): extract profile admission policy — moves _resolve_request_profile / _route_allows_profile / _PROFILE_REJECTED into gateway/platforms/webhook_profile_admission.py as WebhookProfileAdmissionMixin, composed into WebhookAdapter MRO.
4. fix(webhook): preserve profile annotation resolution — preserves profile annotation behavior.

Verification

• tests/gateway/test_webhook_profile_admission_seam.py + tests/test_web_server_webhooks_seam.py → 5 passed on rebased base.
• No behavior change: verbatim extraction, seam identity preserved, monkeypatch surfaces tested.

2K invariant

web_server.py reduced 161 lines; webhook.py reduced 70 lines. No file exceeds 2,000 lines.

Fixes #85054

[andrexibiza]

Class closure — selective multiplex admission authority

Production chain

WebhookAdapter._resolve_request_profile() reads the authoritative gateway config and calls profiles_to_serve(multiplex=True, profile_allowlist=cfg.multiplex_profile_allowlist). The extraction had dropped that second argument. Because None means “serve every named profile,” the omission silently broadened a configured selective allowlist.

The repair belongs at that extracted authority boundary—not in downstream route checks and not as an independently reconstructed policy—so every consumer observes the same configuration authority.

Evidence chain

• Exact defective parent: ececc7c02563e53c942a7dbe9acdc3b5b49da807.
• RED reproduction: observed [(True, None)]; expected [(True, ["worker"])].
• Canonical final head/tree: 898a3f008259a8620d8d5f6eb2e1bf9e5f2b3179 / 1a07947ec6abcac8b573ced206a37695ec3b6c28.
• Final exact-head matrix: 49/49 focused tests passed—seven tests on each of seven repaired PR heads.
• Canonical broader webhook selection: 43/43 passed.
• Ruff check/format, compilation, git diff --check, attribution, and current-main composition passed.
• Semantic replay patch ID: b1586ab2accb0fc7516984b32a694f8fcee37237.
• Format-only patch ID: 99c7a488ddb880e1b249ae8cf0be02d94fb83352; AST-identical on all seven branches.
• Two independent final-object reviews: APPROVED at 898a3f00… / 1a07947e….
• Current-head CI: SUCCESS on all seven PRs.
• Published graph readback: issue Webhook profile admission drops selective multiplex allowlist across extracted branches #85054 sees EPIC Webhook Feature Package — graph-gated repair (meta-issue) #84834 and all seven PRs; receipt SHA-256 bb1b819db783d98cbcc4665caac020549a7c5f4f865c8244680a20543fc13139.

Sibling map

PR	Surface	Final head	Class edge	CI
#84835	Profile-admission origin	898a3f008259	Fixes #85054	✅
#84849	Auth extraction descendant	5f270716c07b	Related #85054	✅
#84858	Rendering extraction descendant	fad39719caa0	Related #85054	✅
#84939	Delivery extraction descendant	4594059f0c7f	Related #85054	✅
#84978	Route/store descendant	41152d37e553	Related #85054	✅
#85002	Effective-config descendant	51912f436ed1	Related #85054	✅
#85025	Secret-migration descendant	20a837ad1c77	Related #85054	✅

Issue #85054 remains open behind this PR’s native Fixes edge so maintainer merge closes it through GitHub’s canonical path. The contributor-side defect class is complete across every live carrier.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 85de2235-584e-4c4d-9a16-61731c4ff411

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Enough1122]

AI code review — automated review for reference, author can ignore or act on any point.

refactor(webhook): extract webhook API router + profile admission (Webhook Feature Package)

Solid decomposition of the webhook god-file; the late() binding seam keeps monkeypatch-transparency. Points:

1. Machine-specific artifacts committed — artifacts/webhook-repair/30e9449403c6448d24036ecf31b7f9ceaf67b769/task-04/*.json contain absolute Windows paths (D:\HERMES-TEMP\webhook-revolution\task-04-rest-router) plus commit hashes and timestamps. These are working artifacts of the automation that produced the PR and should not be part of the repo (or should live under a git-ignored path). Please drop them from the PR.

2. Router extraction is duplicated across PRs in this series — refactor(webhook): extract webhook API router + profile admission (Webhook Feature Package) #84835, refactor(webhook): extract signature validation into webhook_auth mixin (Webhook Feature Package) #84849, refactor(webhook): extract prompt rendering into webhook_rendering mixin (Webhook Feature Package) #84858 and refactor(webhook): extract delivery into webhook_delivery mixin (Webhook Feature Package) #84939 each add the byte-identical hermes_cli/web_routers/webhooks.py + web_server.py change (same files, same content, same base commit). Merging any one makes the others conflict. Coordinate so the router extraction lands exactly once (e.g., in the first PR of the series) and the rest rebase onto it.

3. create_webhook — None-guard gap (pre-existing, now touchable): hermes_cli/web_routers/webhooks.py: "events": [e.strip() for e in body.events if e.strip()] raises TypeError when body.events is None (same for body.skills). Since the router is being extracted anyway, a (body.events or []) guard would harden the dashboard endpoint against partial payloads.

4. MRO test brittleness — tests/gateway/test_webhook_profile_admission_seam.py asserts an exact __mro__[:3] prefix; later PRs in this series add more mixins and had to relax this to a membership assertion. Consider the membership form now to avoid churn.

[andrexibiza]

The webhook API router extraction is complete at exact head 159d70a78f052c40d8c4d8f2ff0a94a276fc4b9f. 159d70a78f05 records the behavior-preserving move of the REST cluster into hermes_cli/web_routers/webhooks.py, with web_server.py re-exporting the patched names used by existing callers and tests. The resulting surface keeps the profile-admission and summary-resolution seams intact, so endpoint routing can be separated from the large server module without changing request behavior. GitHub check rollup on this exact head: SUCCESS.

[teknium1]

Thanks @andrexibiza for this refactor. Closing as superseded: the webhook REST cluster left hermes_cli/web_server.py on main via direct commits (0cca195) as hermes_cli/web_routers/ops.py (list_webhooks/enable_webhooks/create_webhook/delete_webhook), and the profile-admission logic (_resolve_request_profile, _route_allows_profile, _handle_profile_ingress with multiplex_profiles gating — 8c5e846) is implemented directly on WebhookAdapter in gateway/platforms/webhook.py; #85054 is closed as completed. Appreciate the work.